Privacy notice

The controller of your personal data is:

Legal name

HMH SISTEMAS S.A. de C.V.

Trade name

HMH Sistemas

Address

Rinconada Jacaranda 979, Col. Camino Real, Colima, Col.

Postal code

28043

RFC (Mexican tax ID)

HSI160224QC2

Privacy and ARCO rights email

soporte@hmhfour.com

Phone

3121192934

Personal data officer or department

Humberto Ramírez González

This notice applies to the hmhfour.com site and the HMHfour application (app.hmhfour.com). In them, HMH Sistemas can have two roles:

• Controller, for the data of people who visit the site, create or use an account and subscribe to a plan.
• Processor, for the data of employees and other people that a customer organization uploads to the app, for example HR information. In that case the organization is the controller, and HMH Sistemas processes the data on its behalf and following its instructions.

The relationship with customer organizations is governed by the Terms and conditions.

The data we process depends on how you use the site and the application.

If you visit the site

When you browse hmhfour.com we process:

• Technical data the server logs on each visit: your IP address and user agent (type of browser and device).
• Your theme preference (light, dark or system), which is stored only in your browser and is not sent to our servers.
• Site usage data measured by Google Analytics 4, only if you accept analytics cookies.
• The data you send us if you write to us by email, such as your name, your email address and the content of your message.

If you create or use an account in the app

When you use HMHfour we process, depending on the features you use:

• Your account and profile data, such as your name, your email and your login credentials.
• Your activity data, such as tasks, comments, time entries, absence requests, attachments and the change history.
• Your chat messages, announcements and notifications, and your presence status (online or last seen).
• Your preferences, such as theme, colors, backgrounds, text size and notifications.

If you subscribe to a plan

Payment is made inside the app and processed by Stripe. Stripe receives and processes the payment data you provide under its own privacy notice.

Ads

Some free plans of the app may show Google AdSense ads; in that case, Google may use cookies or other identifiers to show them. The hmhfour.com site does not show ads.

The site does not request sensitive personal data.

Within the app, a customer organization can upload data about its employees, such as salary, bank account, RFC, performance reviews and documents. The organization decides what data it uploads and, as controller, must have the consent or other legal basis the law requires, including express consent when the data is sensitive. In the app, this data is only visible to the roles that have permission, for example administration and HR.

Necessary purposes

These purposes are necessary to provide the service, so they do not require additional consent:

• Operating and maintaining the site and the application.
• Creating and managing your account and access.
• Processing payments and managing your plan.
• Answering your questions and support requests.
• Keeping things secure, and detecting and preventing abuse and failures.
• Complying with legal obligations and responding to requests from authorities.

Voluntary purposes

These purposes are not necessary to provide the service and are only carried out with your consent:

• Measuring how the site is used with Google Analytics 4 in order to improve it.
• Showing ads in the free plans that include them.

You can refuse or withdraw your consent at any time; see how on the Cookies page or write to the privacy email.

To operate the site and the application we share data with these providers, only as needed for each purpose:

• Stripe: payment processing inside the app.
• Google (Google Analytics 4): site analytics, with your consent.
• Google (AdSense): ads in some free plans of the app, with your consent.

We may also disclose data to an authority when a law or an order from a competent authority requires it.

The details of cookies and similar technologies, with their purpose and duration, are in the Cookies policy. Your theme preference is stored in your browser's local storage.

Google and Stripe may process personal data in the United States and in other countries. If you use the services that rely on them, your data may be processed outside Mexico.

You have the right to:

• Access your personal data and know the conditions under which it is processed.
• Rectify your data when it is inaccurate, incomplete or outdated.
• Cancel your data so that we stop processing it.
• Object to the processing of your data for certain purposes.

To exercise them, write to the privacy email listed in the Data controller section and include:

• Your name, a way to reply to you and a document that proves your identity or your representative's.
• The right you want to exercise.
• A clear description of the data you are exercising it over.

We will answer your request within 10 days. Exercising your rights is free of charge.

To withdraw your consent, use the same channel.

If your request concerns data that an organization uploaded to the app, that organization is the controller and must handle it; HMH Sistemas supports it under the Terms and conditions.

You can ask us to limit the use or disclosure of your data by writing to the privacy email. For analytics cookies and ads, you can also adjust your preferences as explained on the Cookies page.

We keep your data while your account is active and for as long as needed to fulfill the purposes of this notice and legal obligations. After you cancel your account, we keep it for 30 days.

We apply administrative, technical and physical security measures to protect your data, such as role-based access control inside the app.

The site and the application are not directed at people under 16 years old. If you believe a minor has given us personal data, write to the privacy email so we can look into it.

When we change this notice, we will publish the current version on this page with its last updated date. We recommend checking it from time to time.

If you believe your rights have been violated, you can go to the Secretaría Anticorrupción y Buen Gobierno (Mexico's Ministry of Anti-Corruption and Good Governance), the authority for the protection of personal data held by private parties.

This notice is published in Spanish and English. If the two versions differ, the Spanish version prevails.